Blog: Operators
STIR/SHAKEN checks the number, not what the caller says
By the TelecomsXChange engineering team ยท
STIR/SHAKEN is caller ID authentication. The originating carrier signs the calling number with an attestation level, and the terminating carrier checks the signature. That proves which carrier vouched for the number. It says nothing about the conversation, so a scam placed from a number the scammer legitimately holds passes with full attestation. Call content analysis covers that case by reading what was said on the call.
How it works
How STIR/SHAKEN attestation works
STIR stands for Secure Telephone Identity Revisited, the IETF standards for signing a calling number. SHAKEN stands for Signature-based Handling of Asserted information using toKENs, the industry profile carriers use to deploy them. When a call leaves the originating carrier, that carrier adds a signed token to the SIP INVITE in an Identity header. The token names the calling number, the called number and an attestation level. The terminating carrier fetches the signer's certificate, checks the signature, and can pass the result to the handset or to its call-blocking analytics.
| Level | Knows the customer | Knows they may use the number | Typical case |
|---|---|---|---|
| A (full) | yes | yes | a subscriber calling from a number the carrier assigned to them |
| B (partial) | yes | no | a PBX or enterprise trunk presenting numbers the carrier did not assign |
| C (gateway) | no | no | a call that entered from an international gateway or an unsigned peer |
In the United States the TRACED Act led the FCC to require large voice providers to deploy STIR/SHAKEN in the IP portions of their networks by 30 June 2021, with an extension for small providers. Providers also file in the FCC's Robocall Mitigation Database, and since 28 September 2021 other carriers may not directly accept traffic from a provider that is not listed there. In Canada, Telecom Decision CRTC 2021-123 made STIR/SHAKEN on IP-based voice calls a condition of offering service from 30 November 2021, with no exemption for smaller providers.
Limits
What STIR/SHAKEN cannot see
On the day the US deadline passed, the FCC's own news release stated the limit: STIR/SHAKEN "does not mean the call itself is legitimate." Four kinds of scam call get through.
- Scams from numbers the caller holds. A scammer who signs up for a number, or uses a compromised account, gets A-level attestation on every call. The signature is honest. The call is still a scam.
- Calls that lose their signature. The Identity header lives in SIP. A call that crosses a TDM segment arrives without it and is treated as unverified, the same as a spoofed one, so a missing signature tells the terminating carrier little.
- International traffic. Calls that start outside the framework enter through a gateway and get C-level attestation at best, and much of the scam traffic aimed at North America starts abroad.
- The conversation itself. Attestation is decided before the phone rings. A caller who claims to be the victim's bank, asks for a one-time code or pushes a transfer to a "safe account" says so after the signature has been checked.
Comparison
STIR/SHAKEN vs call content analysis
The two answer different questions, at different moments, from different inputs.
| Question | STIR/SHAKEN | Call content analysis |
|---|---|---|
| What does it judge? | who vouched for the calling number | what was said on the call |
| When does it run? | at signalling time, before the phone rings | after hangup, or during the call in realtime mode |
| What does it need? | signed SIP on an IP path end to end | the audio of both legs |
| Catches a spoofed bank number | yes, if the path is signed | yes, from the conversation |
| Catches a scam from a real, new number | no, it gets A-level attestation | yes, the ask is the same |
| Leaves evidence | a verification result in signalling | the recording, transcript and quoted red flags |
| Required by regulators | yes, in the United States and Canada | no |
For operators
Keep attestation and add the conversation
STIR/SHAKEN stays, because regulators require it and because it removes cheap spoofing. What it leaves is the scam call that looks clean at signalling time. TCXC Open Voice Shield sits in the call path as one SIP hop: the switch routes calls to it, all of them or a sample, like any carrier. It records both legs, transcribes them and scores the call block, review or allow with the red flags quoted from what was said. An automation rule then blocks or diverts the number's next call. In standard mode the verdict lands minutes after hangup. Realtime mode, set up on request at a higher cost, scores the call while it is still up.
For a mobile operator the same hop can be sold to subscribers as scam call protection: scam call protection your subscribers pay for. For the definitions of the terms in this post, see the glossary.
Questions
Frequently asked questions
Does A-level attestation mean a call is safe?
No. A-level attestation means the originating carrier knows its customer and that the customer may use the calling number. A scammer with a number of their own gets A-level attestation on every call. The FCC said so when the framework went live: STIR/SHAKEN improves caller ID information, but it does not mean the call itself is legitimate.
Does STIR/SHAKEN stop robocalls?
It stops one technique, spoofing a number on an IP network, from passing unnoticed, and it gives blocking tools and investigators a signed record of which carrier vouched for a call. It does not stop robocalls placed from numbers the caller holds legitimately, calls whose signature was lost on a non-IP segment, or calls that entered the network through a gateway with C-level attestation.
Is STIR/SHAKEN required in Canada?
Yes. The CRTC required telecommunications service providers to authenticate and verify caller ID on IP-based voice calls with STIR/SHAKEN as a condition of offering service, effective 30 November 2021, with no exemption for smaller providers.
Can call content analysis replace STIR/SHAKEN?
No, and it is not meant to. STIR/SHAKEN is a regulatory requirement and judges the number at signalling time, before the phone rings. Content analysis judges the conversation, so it needs the call to happen. A carrier keeps attestation and adds content analysis to catch what attestation passes.
What does call content analysis need from the network?
The audio. TCXC Open Voice Shield gets it by being one SIP hop on the trunk: the switch routes calls, or a sample of them, through it like any carrier, it records both legs, transcribes them and scores the conversation. Nothing is installed on the switch or the handset.